[Mimedefang] Q about Rejecting based on charset

[James Ebright]

On Fri, 24 Jun 2005 12:25:13 -0400 (EDT), Dirk the Daring wrote
> I've noticed that a lot of the SPAM that I get uses oddball character
> sets, while most of my HAM is either US-ASCII or UTF-8. Examining the
> SPAM a bit more, I've compiled a list of about 8 character sets that 
> are apparently always SPAM.
> 
>    I found some sample filter code on a website, and I'm trying to adapt
> it to what I want to do, which is reject E-Mail using these character
> sets. I'd appreciate a sanity-check of both the code and the idea.


Would this not be better served by leaving this to Spamassassin? If it is not
scoring high enough with the default rules add your own 80_modified_scores.cf
file to your /etc/mail/spamassassin directory with higher scores? Or maybe
write your own rules for these 8?

Also, I see valid email with the windows-12XX charsets all the time. (The
windows-1255 charset is one Open webmail has had issues displaying in the past).

These are SA's default scores (3000004):

score CHARSET_FARAWAY_HEADER 3.200
score NONEXISTENT_CHARSET 0 0 1.411 1.418
score HTML_CHARSET_FARAWAY 0.500
score MIME_CHARSET_FARAWAY 2.450
score FORGED_MUA_THEBAT_CS 1.345 0.413 1.213 1.877

There are also some that do not have entries in the default scores file like:
RATWARE_CHARSET
RATWARE_CHARSET_V2

So I guess they score a 1

Jim



--
EsisNet.com Webmail Client